Vulnerability · Published Jan 9, 2024 · Assigned by redhat
CVE-2023-6476Cri-o: pods are able to break out of resource confinement on cgroupv2
Medium 6.5
In plain English
A medium-severity resource allocation without limits in Red Hat OpenShift Container Platform 3.11 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 59% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A flaw was found in CRI-O that involves an experimental annotation leading to a container being unconfined. This may allow a pod to specify and get any amount of memory/cpu, circumventing the kubernetes scheduler and potentially resulting in a denial of service in the node.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/cri-o/cri-o | 1.29.1 | GHSA-p4rx-7wvg-fwrc |
| Go | github.com/cri-o/cri-o | 1.28.3 | GHSA-p4rx-7wvg-fwrc |
| Go | github.com/cri-o/cri-o | 1.27.3 | GHSA-p4rx-7wvg-fwrc |
| Go | github.com/cri-o/cri-o | 1.27.3, 1.28.3, 1.29.1 | GO-2024-2458 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | Red Hat OpenShift Container Platform 4.13 | see references |
| Red Hat | Red Hat OpenShift Container Platform 4.14 | see references |
| Red Hat | Red Hat OpenShift Container Platform 3.11 | see references |
Weakness: CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
References
- RHSA-2024:0195 vendor-advisory, x_refsource_REDHAT
- RHSA-2024:0207 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2023-6476 vdb-entry, x_refsource_REDHAT
- RHBZ#2253994 issue-tracking, x_refsource_REDHAT